CVE-2024-27920
📋 TL;DR
This vulnerability in Nuclei v3 allows execution of unsigned code templates through workflows, potentially enabling attackers to run malicious code on systems using custom workflows. It affects users who utilize custom workflows in Nuclei v3 before version 3.2.0. The risk is highest for security teams running custom vulnerability scanning workflows.
💻 Affected Systems
- projectdiscovery/nuclei
📦 What is this software?
Nuclei by Projectdiscovery
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through remote code execution, allowing attackers to install malware, exfiltrate data, or pivot to other systems.
Likely Case
Local privilege escalation or execution of arbitrary commands within the context of the Nuclei user, potentially leading to data theft or system manipulation.
If Mitigated
No impact when using only signed, verified templates from trusted sources or when workflows are disabled.
🎯 Exploit Status
Exploitation requires the attacker to craft a malicious workflow that the victim executes. The vulnerability is in template execution logic, not network-facing services.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Nuclei v3.2.0
Vendor Advisory: https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-w5wx-6g2r-r78q
Restart Required: No
Instructions:
1. Update Nuclei using: go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
2. Verify installation with: nuclei -version
3. Ensure version shows 3.2.0 or higher
🔧 Temporary Workarounds
Disable custom workflows
allPrevent execution of custom workflows entirely
nuclei -disable-workflows
Use only signed templates
allConfigure Nuclei to only execute signed, verified templates
nuclei -signature-check
🧯 If You Can't Patch
- Immediately stop using custom workflows and disable workflow functionality
- Only execute templates from trusted, verified sources and avoid downloading templates from untrusted repositories
🔍 How to Verify
Check if Vulnerable:
Check if using Nuclei v3 before 3.2.0 with custom workflows enabledCheck Version:
nuclei -versionVerify Fix Applied:
Run 'nuclei -version' and confirm version is 3.2.0 or higher📡 Detection & Monitoring
Log Indicators:
- Unexpected code execution in Nuclei logs
- Execution of unsigned templates in workflow logs
Network Indicators:
- Unusual outbound connections from Nuclei process
- Downloads from untrusted template repositories
SIEM Query:
process_name:nuclei AND (command_line:*workflow* OR command_line:*template*)🔗 References
- https://docs.projectdiscovery.io/templates/protocols/code
- https://docs.projectdiscovery.io/templates/reference/template-signing
- https://docs.projectdiscovery.io/templates/workflows/overview
- https://github.com/projectdiscovery/nuclei/pull/4822
- https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-w5wx-6g2r-r78q
- https://docs.projectdiscovery.io/templates/protocols/code
- https://docs.projectdiscovery.io/templates/reference/template-signing
- https://docs.projectdiscovery.io/templates/workflows/overview
- https://github.com/projectdiscovery/nuclei/pull/4822
- https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-w5wx-6g2r-r78q
